ansible-role-security VS network

My playbook is only doing some software installation (openzfs, ...) and some SSH configuration (something really similar to jeff geerling : https://github.com/geerlingguy/ansible-role-security ), and it works perfectly without the tasks where I create groups and add user to these groups.

I suggest these resources: - Some fundamentals: https://www.cyberciti.biz/tips/linux-security.html - One of the best imho ( exhaustive list ): https://github.com/imthenachoman/How-To-Secure-A-Linux-Server - Ansible playbook to harden security by Jeff Geerling: https://github.com/geerlingguy/ansible-role-security - OAWSP Check list ( targeted for web apps... and honestly a bit overkill ): https://github.com/0xRadi/OWASP-Web-Checklist

THAT all being said. Check out this: https://github.com/geerlingguy/ansible-role-security. YOu can see everything Jeff Does. My guy is a mad genious :).

Solid advice, most of it is now covered by GeerlingGuy's Security Ansible role (https://github.com/geerlingguy/ansible-role-security) and the Firewall one (https://github.com/geerlingguy/ansible-role-firewall).

yea, what jessel0l said (or vlan) plus you could use something like chroot or podman to separate privileges. Remember to set up fail2ban sane and easy starting point might be https://github.com/geerlingguy/ansible-role-security

Yes, if they are still RHEL-based, those should work. In fact, you might be fine with the upstream linux-system-roles:https://linux-system-roles.github.io/

So, keeping that in mind, the are no docs for linux-system-roles/network on docs.ansible.com. The docs for that role is part of the README.md in the on that github link. Also there seem to be lots of examples. Past that, the code, is often the most accurate documentation. So, when if you can't find anything else for a given role, you may have to actually look at the various tasks/vars/etc files that are part of the role.

But where do phase2-auth, autoconnect-priority go? What about PEAP? The readme states, that only tls is supported atm - is this true? https://github.com/linux-system-roles/network How do I configure "ignore certificate" (don't judge me - I didn't set up the network ;-) )